@bakery-framework/core 2.0.0-alpha.3 → 2.0.0-alpha.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/core",
-  "version": "2.0.0-alpha.3",
+  "version": "2.0.0-alpha.5",
   "description": "Bakery framework core: handlers, router, config, session, caches, logger, compiler.",
   "keywords": [
     "bakery",

package/src/handlers/routes/api.ts

@@ -2,6 +2,7 @@ import { Bakery } from '../../core/bakery'
 import { handlerLog } from '../../logger/serve-log'
 import { FileSystem } from '../../utils/fs'
 import { checkCsrf, response } from '../../utils/http'
+import { parsedUrl } from '../../utils/http/url'
 import type { Handler } from '../core/$base'
 import { bustInDev, DynamicHandler } from '../core/$dynamic'
 import { ErrorHandler } from '../core/$error'
@@ -29,8 +30,7 @@ export class ApiHandler extends DynamicHandler {
   static async handle(path: string, req: Request) {
     // State-changing methods must be same-origin. SameSite=Lax alone does not
     // cover this: a cross-site form POST is a CORS-simple request.
-    const url: URL = (req as any).__parsedUrl || new URL(req.url)
-    const csrf = checkCsrf(req, url)
+    const csrf = checkCsrf(req, parsedUrl(req))
     if (csrf) return response.json.error(403, csrf) as unknown as Response
 
     const info = await this.resolveRoute(path)

package/src/handlers/routes/proxy.ts

@@ -1,6 +1,7 @@
 import { Bakery } from '../../core/bakery'
 import { handlerLog } from '../../logger'
 import { response } from '../../utils/http'
+import { parsedUrl } from '../../utils/http/url'
 import { Handler } from '../core/$base'
 
 export class ProxyHandler extends Handler {
@@ -30,7 +31,7 @@ export class ProxyHandler extends Handler {
         baseTarget +
         (trailingPath.startsWith('/') ? '' : '/') +
         trailingPath +
-        ((req as any).__parsedUrl || new URL(req.url)).search
+        parsedUrl(req).search
       break
     }
 

package/src/router.ts

@@ -19,6 +19,7 @@ import {
   withStatus,
 } from './utils/http'
 import { applyCors, preflightResponse } from './utils/http/cors'
+import { parsedUrl } from './utils/http/url'
 
 /**
  * Resolve a WebSocket upgrade, refusing cross-origin handshakes first.
@@ -39,7 +40,7 @@ export async function upgradeWebsocket(
   req: Request,
   path: string,
 ): Promise<boolean | undefined> {
-  const url: URL = (req as any).__parsedUrl || new URL(req.url)
+  const url = parsedUrl(req)
   const denied = checkWebSocketOrigin(req, url)
   if (denied) {
     serveLog.WEBSOCKET_ERR({
@@ -85,10 +86,9 @@ export function handleRequest(
   req: Request,
 ): Handler.Response | MixedPromise<symbol>
 export async function handleRequest(req: Request) {
-  // worker.ts parses and attaches this before calling in; the fallback keeps
-  // direct callers (tests, embedders) working.
-  const url: URL = (req as any).__parsedUrl || new URL(req.url)
-  ;(req as any).__parsedUrl = url
+  // Shared with worker.ts, which has already asked for the same parse; a
+  // direct caller (test, embedder) gets it parsed here instead.
+  const url = parsedUrl(req)
   const path = url.pathname
 
   // One read of the config getter, not three: `Bakery.serveRoot` walks

package/src/utils/http/authorize.ts

@@ -0,0 +1,129 @@
+/**
+ * The request-predicate half of plugin authorization.
+ *
+ * One implementation, deliberately in core, for the same reason
+ * `credential.ts` is here: the dashboard, db-explorer and analytics plugins
+ * each need this guard, and per-plugin copies of security code drift. These
+ * three had already drifted — one coerced its predicate's return with
+ * `Boolean`, one gated on `!DEV` where the others read `PROD`, one swallowed a
+ * `getClientIp` throw into an empty string and carried on. Each divergence is
+ * resolved below toward the fail-closed reading, and each is marked as a
+ * decision rather than left to look like a style choice.
+ *
+ * It owns *only* the predicate — no logins, no sessions, no backoff. The shared
+ * key path is `credential.ts`; a plugin that offers both doors composes them.
+ *
+ * `getClientIp` is imported from `./ip` directly, never through this
+ * directory's barrel or `@bakery-framework/core`: a core module that reaches for a
+ * barrel closes an import cycle, which is how 67 tests once failed with
+ * `ReferenceError: Cannot access 'Logger' before initialization`.
+ */
+
+import { getClientIp } from './ip'
+
+/**
+ * A host application's access predicate. Returning `true` admits; returning
+ * anything else, or throwing, denies (convention 2).
+ *
+ * The framework authenticates nobody. The application, which already knows who
+ * its users are, supplies this.
+ */
+export type AuthorizeFn = (req: Request) => boolean | Promise<boolean>
+
+/**
+ * Addresses only, never hostnames. Module-private: neither plugin copy
+ * exported it, and the membership test is the whole of the useful surface.
+ *
+ * `'localhost'` used to be a member, back when the request's *hostname* was
+ * compared against this set as well. A peer address is never the string
+ * `localhost`, and accepting it meant `X-Forwarded-For: localhost` counted as
+ * loopback under `trustProxy` — and, worse, that `new URL(req.url).hostname`
+ * did too. Bun builds that from the client's own `Host` header and
+ * `DEFAULT_HOST` is 0.0.0.0, so any peer on the LAN could send
+ * `Host: localhost` and be handed a database browser.
+ */
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
+
+/** True when the request came from this machine. */
+export function isLoopback(req: Request): boolean {
+  // The peer address is the only evidence here the client does not choose.
+  //
+  // DECISION (divergence 3): a throw returns `false` immediately rather than
+  // falling through with `ip = ''`. `getClientIp` reads config and the live
+  // server, either of which may be absent (tests, early boot). The two spell
+  // the same answer today, because `LOOPBACK.has('')` is false — but only by
+  // coincidence, and the fall-through invites a later edit that adds a second
+  // source of evidence below this line and silently consults it on the
+  // indeterminate path. Returning here says the answer is settled: no address
+  // means no evidence, and per convention 2 an indeterminate answer is a
+  // denial, not a reason to ask something the requester controls.
+  try {
+    return LOOPBACK.has(getClientIp(req))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * The default when an application configures no predicate: loopback in
+ * development, nobody in production. Forgetting to configure a plugin
+ * therefore cannot expose it to the internet.
+ */
+export function defaultAuthorize(req: Request): boolean {
+  // DECISION (divergence 2): gate on `PROD`, not `!DEV`, and read it at call
+  // time — the mode flags are accessors on `process.env` (`core/init.ts`), so
+  // they are process state and tests flip them.
+  //
+  // The two spellings look interchangeable because `init.ts` derives them as
+  // complements (`PROD = !isDev && !--dev-worker`). They are not, because they
+  // are *independently settable* accessors and the test fixtures set them one
+  // at a time: `asDev` flips `DEV` alone and leaves the ambient `PROD` — which
+  // under `bun test` is `true` — in place. In that state `!DEV` admits a
+  // loopback caller and `PROD` denies, so `PROD` is both the fail-closed
+  // reading and the one that literally names the condition it means, rather
+  // than inferring production from the absence of development.
+  //
+  // Hence `!== false` rather than a plain truthiness test, which is the one
+  // place a bare `PROD` gate would be *weaker* than `!DEV`. The flag does not
+  // exist until `core/init.ts` has run, and `if (undefined)` falls straight
+  // through to the loopback check — so an uninitialised process would open the
+  // door that an initialised production one keeps shut. `init.ts` defines
+  // `PROD` as a real boolean (`accessor(!isDev && !hasDevWorkerArg)`), so
+  // "explicitly false" is a statement only a booted development server can
+  // make. Unset is not evidence of development; it is no evidence at all.
+  //
+  // `isLoopback` would very likely deny on its own there, having no config or
+  // server to read an address from. That is a second line of defence, not this
+  // one's excuse: a guard should not depend on another guard's failure mode.
+  if (import.meta.env.PROD !== false) return false
+  return isLoopback(req)
+}
+
+/** The configured predicate, or the fail-closed default. */
+export function resolveAuthorize(fn?: AuthorizeFn): AuthorizeFn {
+  return fn ?? defaultAuthorize
+}
+
+/**
+ * Run a predicate without letting a broken one grant access. Guard semantics
+ * per convention 2: the *authorizer* may throw or answer nonsense, and the
+ * answer to any indeterminate state is denial.
+ */
+export async function isAuthorized(
+  authorize: AuthorizeFn,
+  req: Request,
+): Promise<boolean> {
+  try {
+    // DECISION (divergence 1): `=== true`, never `Boolean(...)`. The predicate
+    // comes from application code and `AuthorizeFn`'s return type is only
+    // advice — an untyped, transpiled or `as any` predicate can hand back
+    // anything. `Boolean` admits every truthy non-boolean, so a check that
+    // answers with a status string denies on `""` and *grants* on `"no"`, and
+    // one that answers with a count grants on any non-zero. Admission is the
+    // expensive direction to get wrong; require the exact affirmative.
+    return (await authorize(req)) === true
+  } catch {
+    // A predicate that throws is indeterminate, and indeterminate is denied.
+    return false
+  }
+}

package/src/utils/http/body.ts

@@ -1,4 +1,5 @@
 import type { MapOf } from '../../types'
+import { parsedUrl } from './url'
 
 export async function processBody(req: Request): Promise<MapOf<any>> {
   const getParsedBody = async (): Promise<MapOf<any>> => {
@@ -18,8 +19,7 @@ export async function processBody(req: Request): Promise<MapOf<any>> {
 }
 
 function getBodyFromURI(req: Request): MapOf<any> {
-  const url = (req as any).__parsedUrl || new URL(req.url)
-  const searchParams = url.searchParams
+  const searchParams = parsedUrl(req).searchParams
   return Object.fromEntries(searchParams.entries())
 }
 

package/src/utils/http/index.ts

@@ -1,3 +1,4 @@
+export * from './authorize'
 export * from './body'
 export * from './credential'
 export * from './csrf'
@@ -8,3 +9,4 @@ export * from './html'
 export * from './ip'
 export * from './response'
 export * from './sse'
+export * from './url'

package/src/utils/http/url.ts

@@ -0,0 +1,35 @@
+/**
+ * The request's parsed URL, parsed at most once.
+ *
+ * Why memoize at all: `new URL` measures ~1.7µs, and the router, the body
+ * parser and the proxy handler all want the same parse of the same request —
+ * so the parse was hoisted into the server's `fetch` in `packages/cli/src/worker.ts`
+ * and shared.
+ *
+ * Why a `WeakMap` rather than the property it replaces. The memo used to be
+ * `(req as any).__parsedUrl`: two writers, six readers across three packages,
+ * every reader spelled `(req as any).__parsedUrl || new URL(req.url)` so that
+ * it silently re-parsed whenever the writer had not run first. That is a
+ * writer/reader ordering hazard with no way to observe it going wrong — a
+ * missed write costs microseconds, not correctness, so nothing ever fails.
+ * One function collapses both roles: there is no ordering left to get wrong,
+ * no `any` cast anywhere, and no writer to forget. The map also keeps the
+ * framework from mutating a `Request` object it does not own — a caller's
+ * `Request` goes in and comes back unchanged — and holds its keys weakly, so
+ * an entry dies with the request rather than needing eviction (convention 6).
+ *
+ * There is deliberately no setter. Nothing outside this module needs to say
+ * what a request's URL is; `req.url` already does.
+ */
+
+const cache = new WeakMap<Request, URL>()
+
+/** The parsed `req.url`, cached per request. */
+export function parsedUrl(req: Request): URL {
+  const cached = cache.get(req)
+  if (cached) return cached
+
+  const url = new URL(req.url)
+  cache.set(req, url)
+  return url
+}